Blame SOURCES/0202-Download-complete-groups-if-ignore_group_members-is-.patch

e543c9
From 591ee6dee11c4509e8e748ce83414913143e751d Mon Sep 17 00:00:00 2001
e543c9
From: Jakub Hrozek <jhrozek@redhat.com>
e543c9
Date: Fri, 22 May 2015 15:19:31 +0200
e543c9
Subject: [PATCH 202/207] Download complete groups if ignore_group_members is
e543c9
 set with tokengroups
e543c9
e543c9
Resolves:
e543c9
    https://fedorahosted.org/sssd/ticket/2644
e543c9
e543c9
When tokenGroups are enabled, we save groups using their SID as the RDN
e543c9
attribute during initgroups() and later, if the groups is requested and saved
e543c9
again with the full name, remove the original and save the new group entry.
e543c9
e543c9
Saving the new group entry would break if ignore_group_members is also
e543c9
set, because the new group entry would lack the "member" attribute, so the
e543c9
member/memberof links between the new group and the user entry wouldn't
e543c9
be established again.
e543c9
e543c9
This patch changes the initgroups processing so that the full group
e543c9
object is fetched when initgroups is enabled but together with
e543c9
ignore_group_members. This solution imposes some performance impact,
e543c9
because instead of one search for tokenGroups we also need to resolve the
e543c9
groups. The more systematic solution would be to get rid of removing the
e543c9
group entry as described in https://fedorahosted.org/sssd/ticket/2656
e543c9
e543c9
To reproduce the bug, set: ignore_group_members = True with a
e543c9
backend that uses:
e543c9
    id_provider = ad
e543c9
Then run:
e543c9
    $ id aduser@ad_domain.com
e543c9
    $ id aduser@ad_domain.com
e543c9
e543c9
Reviewed-by: Sumit Bose <sbose@redhat.com>
e543c9
(cherry picked from commit ee44aac95e42c3cb634876286a2aa4960ac69a2b)
e543c9
---
e543c9
 src/providers/ldap/sdap_async_initgroups_ad.c | 17 +++++++++++++++--
e543c9
 1 file changed, 15 insertions(+), 2 deletions(-)
e543c9
e543c9
diff --git a/src/providers/ldap/sdap_async_initgroups_ad.c b/src/providers/ldap/sdap_async_initgroups_ad.c
e543c9
index 9915f18..463d850 100644
e543c9
--- a/src/providers/ldap/sdap_async_initgroups_ad.c
e543c9
+++ b/src/providers/ldap/sdap_async_initgroups_ad.c
e543c9
@@ -1445,7 +1445,18 @@ sdap_ad_tokengroups_initgroups_send(TALLOC_CTX *mem_ctx,
e543c9
     state->use_id_mapping = use_id_mapping;
e543c9
     state->domain = domain;
e543c9
 
e543c9
-    if (state->use_id_mapping && !IS_SUBDOMAIN(state->domain)) {
e543c9
+    /* We can compute the the gidNumber attribute from SIDs obtained from
e543c9
+     * the tokenGroups lookup in case ID mapping is used for a user from the
e543c9
+     * parent domain. For trusted domains, we need to know the group type
e543c9
+     * to be able to filter out domain-local groups. Additionally, as a
e543c9
+     * temporary workaround until https://fedorahosted.org/sssd/ticket/2656
e543c9
+     * is fixed, we also fetch the group object if group members are ignored
e543c9
+     * to avoid having to transfer and retain members when the fake
e543c9
+     * tokengroups object without name is replaced by the full group object
e543c9
+     */
e543c9
+    if (state->use_id_mapping
e543c9
+            && !IS_SUBDOMAIN(state->domain)
e543c9
+            && state->domain->ignore_group_members == false) {
e543c9
         subreq = sdap_ad_tokengroups_initgr_mapping_send(state, ev, opts,
e543c9
                                                          sysdb, domain, sh,
e543c9
                                                          name, orig_dn,
e543c9
@@ -1485,7 +1496,9 @@ static void sdap_ad_tokengroups_initgroups_done(struct tevent_req *subreq)
e543c9
     req = tevent_req_callback_data(subreq, struct tevent_req);
e543c9
     state = tevent_req_data(req, struct sdap_ad_tokengroups_initgroups_state);
e543c9
 
e543c9
-    if (state->use_id_mapping && !IS_SUBDOMAIN(state->domain)) {
e543c9
+    if (state->use_id_mapping
e543c9
+            && !IS_SUBDOMAIN(state->domain)
e543c9
+            && state->domain->ignore_group_members == false) {
e543c9
         ret = sdap_ad_tokengroups_initgr_mapping_recv(subreq);
e543c9
     } else {
e543c9
         ret = sdap_ad_tokengroups_initgr_posix_recv(subreq);
e543c9
-- 
e543c9
2.1.0
e543c9